Read the docs
TI-2026-85696 Aliases CVE-2026-88979

Server-side request forgery in Kubeflow Pipelines TensorBoard proxy

Priority HIGH 65CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-798, CWE-918 and the CVSS impact.

Summary

Kubeflow Pipelines from 2.17.0 before 2.18.0 signs TensorBoard proxy tokens with MINIO_SECRET_KEY, whose bundled default is publicly known (CWE-798). In deployments with authorization disabled that keep the default, an unauthenticated remote attacker can forge a token and make the proxy request internal TensorBoard services and read their responses, which is server-side request forgery.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 2.17.0 until 2.18.0, the TensorBoard proxy token introduced by the incomplete remediation for CVE-2026-54745 uses MINIO_SECRET_KEY as its HMAC secret, whose bundled default is publicly known. In an authorization-disabled deployment using that default, an unauthenticated attacker can forge a token containing a chosen viewerName and namespace; the proxy constructs the destination from the viewerName plus the -service suffix, the namespace, and the configured cluster domain, then reads responses on port 80 under the /tensorboard/<viewer>/ path. Resource-name validation and path-traversal rejection remain enforced, authorization-enabled deployments still check access to the selected namespace, and unrestricted metadata access, writes, or service disruption are not established. This issue is fixed in version 2.18.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00232 14th percentileScored 2026-11-07
Fix Partial pipelines (kubeflow): 2.18.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kubeflowpipelines2.17.0 to before 2.18.02.18.0Patch availableCNA
  • pipelines Vendorkubeflow Affected 2.17.0 to before 2.18.0 Fixed in 2.18.0 Patch available CNA

Remediation

Upgrade Kubeflow Pipelines to version 2.18.0. Red Hat OpenShift AI (RHOAI) is listed as affected without a fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA pipelines (kubeflow) Fixed in 2.18.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI (RHOAI)Affected—

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-88979
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat
  4. 2026-11-06 CISA SSVC decision points changed
  5. 2026-11-06 Priority changed: MEDIUM → HIGH

References

Other 4

  • TI-2026-39556 Improper access control in kubeflow pipelines CVSS 3.1CRITICAL 10.0
  • TI-2024-05160 ReDoS in kubeflow/kubeflow CVSS 3.1HIGH 7.5
  • TI-2026-34822 Kubeflow Community Distribution: Overly Permissive Istio Permissions Allows Kubeflow Authorization Token Stealing CVSS 3.1HIGH 8.0
  • TI-2026-73437 Server-side request forgery in Kubeflow Model Registry leaks tokens CVSS 4.0HIGH 7.1
  • TI-2026-85698 Server-side request forgery in Kubeflow Pipelines artifact endpoints CVSS 3.1HIGH 8.6
  • TI-2026-85695 Kubeflow Pipelines API server skips authorization for shared pipeline uploads CVSS 3.1CRITICAL 9.6
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences